CVE-2020-1455 Microsoft SQL Server Management Studio Denial of Service Vulnerability

Medium 5.3 Published 17 Aug 2020 Updated 4 Aug 2024

An attacker with local execution rights can cause a denial of service in SQL Server Management Studio by exploiting improper file handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-1455?

CVE-2020-1455 is a medium-severity denial of service vulnerability in Microsoft SQL Server Management Studio 18.6, published on 17 Aug 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A denial of service vulnerability exists when Microsoft SQL Server Management Studio (SSMS) improperly handles files. An attacker could exploit the vulnerability to trigger a denial of service. To exploit the vulnerability, an attacker would first require execution on the victim system. The security update addresses the vulnerability by ensuring Microsoft SQL Server Management Studio properly handles files.

Which versions are affected by CVE-2020-1455?

It affects 1 product.

Products include Microsoft Sql Server Management Studio.

How do I fix CVE-2020-1455?

No fix has been published for CVE-2020-1455 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-1455 being exploited?

There is no known exploitation of CVE-2020-1455 in the wild and no public exploit code.

Sources

Also known as GHSA-6pcm-x8v9-rgxq.